@jc_stack/ez-agents 0.1.0-beta.33 → 0.1.0-beta.34

package/test/install-tools.test.mjs

@@ -24,6 +24,12 @@ test('installation status separates files, pairing and current-owner Telegram de
   const write=(name,obj)=>fs.writeFile(path.join(control,name),JSON.stringify(obj));
   await write('heartbeat.json',{at:Date.now(),polling:true});await write('host-executor/heartbeat.json',{at:Date.now()});
   assert.equal((await installationStatus(root)).stage,'awaiting-owner');
+  await fs.writeFile(path.join(root,'agent.json'),JSON.stringify({isolation:'isolated'}));
+  await fs.rm(path.join(control,'host-executor/heartbeat.json'));
+  assert.equal((await installationStatus(root)).stage,'awaiting-owner');
+  await fs.writeFile(path.join(root,'agent.json'),'private');
+  await write('host-executor/heartbeat.json',{at:Date.now()});
+  assert.equal((await installationStatus(root)).stage,'awaiting-owner');
   const owner={telegramUserId:123,telegramChatId:123,pairedAt:new Date(Date.now()-10000).toISOString()};await write('control-state.json',{owner});
   assert.equal((await installationStatus(root)).stage,'awaiting-telegram-reply');
   const item={runId:'tg_12',chatId:123,receipt:{messageIds:[42],deliveredAt:new Date().toISOString()}};

package/test/plugin-manager.test.mjs

@@ -169,7 +169,7 @@ test('host-owned private networks survive registered-call Compose regeneration',
  config.hostConfig=await fs.realpath(f.hostConfig);
  await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify(config));
  const file=path.join(f.home,'packages/sample/compose.json');await fs.writeFile(file,'{}');
- await f.call('sample','read');
+ await exec(path.join(f.home,'bin','ez'),['sample','read'],{cwd:f.workspace,env:f.env});
  const c=JSON.parse(await fs.readFile(file,'utf8'));
  assert.deepEqual(c.networks.default,{});
  const [key,network]=Object.entries(c.networks).find(([name])=>name!=='default');
@@ -323,8 +323,8 @@ test('standalone rejects relay binding and preserves literal plugin arguments ac
  }
  const log=(await fs.readFile(f.log,'utf8')).trim().split('\n').map(JSON.parse);
  assert(log.every(call=>call.secret===undefined));
- await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:f.workspace,catalog:{},deploymentDir:'/missing'}));
- await assert.rejects(exec(launcher,['status']),/deployment-bound/); // never hide a broken relay binding
+ await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify({schemaVersion:1,workspace:await fs.realpath(f.workspace),catalog:{},deploymentDir:'/missing'}));
+ await assert.rejects(exec(launcher,['status'],{cwd:f.workspace,env:f.env}),/deployment-bound/); // never hide a broken relay binding
 });
 
 test('existing folders are read-only, persistent and fail closed when missing', async t => {
@@ -349,6 +349,27 @@ test('existing folders are read-only, persistent and fail closed when missing',
  assert.deepEqual(JSON.parse((await f.call('plugins','folders','sample')).stdout),[]);
 });
 
+test('relay registry rejects foreign callers and ungranted host folders', async t => {
+ const f=await fixture(t);await init(f.home,f.workspace);const p=await snapshot(f.source);
+ await f.call('plugins','install','sample','--source',f.source,'--revision',p.revision);
+ await fs.mkdir(path.join(f.root,'allowed'));await fs.mkdir(path.join(f.root,'denied'));
+ const allowed=await fs.realpath(path.join(f.root,'allowed')),denied=await fs.realpath(path.join(f.root,'denied'));
+ const host={cli:'synthetic',agents:[{name:'sample',workspace:f.workspace,controlDir:f.control,binDir:path.join(f.home,'bin'),toolsHome:f.home,pluginFolderRoots:{sample:[allowed]}}]};
+ await fs.writeFile(f.hostConfig,JSON.stringify(host));
+ const config=JSON.parse(await fs.readFile(path.join(f.home,'config.json'),'utf8'));
+ config.hostConfig=await fs.realpath(f.hostConfig);await fs.writeFile(path.join(f.home,'config.json'),JSON.stringify(config));
+ const launcher=path.join(f.home,'bin','ez'),foreign={cwd:f.source,env:f.env};
+ const before=await fs.readFile(f.log,'utf8');
+ await assert.rejects(exec(launcher,['sample','read'],foreign),/Registry belongs/);
+ await assert.rejects(exec(launcher,['--for-workspace',f.workspace,'sample','read'],foreign),/Registry belongs/);
+ assert.equal(await fs.readFile(f.log,'utf8'),before);
+ assert.deepEqual(JSON.parse((await exec(launcher,['sample','read'],{cwd:f.workspace,env:f.env})).stdout),['read']);
+ await exec(launcher,['plugins','folder-bind','sample','--service','sample','--source',allowed,'--target','/data/files'],{cwd:f.workspace,env:f.env});
+ const saved=await fs.readFile(path.join(f.home,'config.json'),'utf8');
+ await assert.rejects(exec(launcher,['plugins','folder-bind','sample','--service','sample','--source',denied,'--target','/data/files'],{cwd:f.workspace,env:f.env}),/not granted/);
+ assert.equal(await fs.readFile(path.join(f.home,'config.json'),'utf8'),saved);
+});
+
 test('folder bindings survive compatible descriptors and reject incompatible updates',async t=>{
  const f=await fixture(t);const p=await snapshot(f.source);
  const record={...p,project:'ezp-test-sample'};

package/test/scheduler.test.ts

@@ -78,10 +78,10 @@ test('pause, edit, removal, owner revocation, corrupt records and traversal fail
 })
 test('task workspaces are distinct and cannot escape through symlinks',async t=>{
  const f=await fixture(t)
- await writeFile(join(f.dir,'SOUL.md'),'Owner context')
+ await writeFile(join(f.dir,'private.md'),'Owner context')
  const first=await taskWorkspace(f.dir,'r_one'),second=await taskWorkspace(f.dir,'r_two')
  assert.notEqual(first,second)
- await assert.rejects(readFile(join(first,'SOUL.md'),'utf8'),{code:'ENOENT'})
+ await assert.rejects(readFile(join(first,'private.md'),'utf8'),{code:'ENOENT'})
  await assert.rejects(readFile(join(first,'AGENTS.md'),'utf8'),{code:'ENOENT'})
  await assert.rejects(taskWorkspace(f.dir,'../escape'))
  const other=join(f.dir,'other');await mkdir(other)

package/test/updates.test.mjs

@@ -12,7 +12,16 @@ import { perform, environment, packageManager } from '../src/updates/runtime.mjs
 import { atomic, snapshot, compose, prepareCommand } from '../src/plugins/manager.mjs';
 import { bindUpdates } from '../src/updates/binding.mjs';
 import { status as runtimeStatus } from '../src/updates/status.mjs';
+import { providerEnvironment } from '../src/updates/supervisor.mjs';
 const exec=promisify(execFile);
+
+test('supervisor forwards only provider keys declared by the agent installation',()=>{
+ const host={agents:[{codexProviders:[{envKey:'OPENROUTER_API_KEY'}]}]};
+ assert.deepEqual(providerEnvironment(host,{OPENROUTER_API_KEY:'provider-secret',TELEGRAM_BOT_TOKEN:'relay-secret'}),{OPENROUTER_API_KEY:'provider-secret'});
+ assert.throws(()=>providerEnvironment({agents:[{codexProviders:[{envKey:'bad-key'}]}]},{}),/environment key/);
+ for(const envKey of ['PATH','HOME','CODEX_HOME','NODE_OPTIONS','EZ_CONTROL_DIR','TELEGRAM_BOT_TOKEN','PAGERDUTY_ROUTING_KEY'])
+  assert.throws(()=>providerEnvironment({agents:[{codexProviders:[{envKey}]}]},{}),/Reserved Codex provider environment key/);
+});
 const contract=kind=>({protocol:1,kind,stateSchema:1,mainProtocol:1});
 function tar(entries) {
  const chunks=[];
@@ -83,7 +92,7 @@ test('status distinguishes installed, running, legacy and stale main versions wi
  }
  await fs.writeFile(relay,'broken');s=await command(f.home,['status']);assert.equal(s.main.state,'unknown');
  await fs.rm(relay);s=await command(f.home,['status']);assert.equal(s.main.state,'offline');
- const result=await exec(process.execPath,[new URL('../bin/ezenciel-agents-tools.mjs',import.meta.url).pathname,'--home',f.home,'status']);
+ const result=await exec(process.execPath,[new URL('../bin/ezenciel-agents-tools.mjs',import.meta.url).pathname,'--home',f.home,'status'],{cwd:f.agent.workspace});
  assert.equal(JSON.parse(result.stdout).main.installedVersion,'0.1.0');
 });
 test('relay healthcheck emits bounded predicate evidence without state contents',async t=>{

package/test/workspace-confine.test.ts

@@ -0,0 +1,47 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises'
+import { spawn } from 'node:child_process'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { macosWorkspaceProfile, workspaceSiblingDenies } from '../src/workspace-confine.js'
+
+test('sibling confinement skips $HOME and filesystem root', () => {
+  assert.deepEqual(workspaceSiblingDenies('/Users/ada/agent', '/Users/ada'), [])
+  assert.deepEqual(workspaceSiblingDenies('/', '/Users/ada'), [])
+})
+
+test('sibling confinement denies the tenant farm, not the bound workspace', () => {
+  assert.deepEqual(workspaceSiblingDenies('/data/tenants/juan', '/Users/ada'), [
+    { deny: '/data/tenants', allow: '/data/tenants/juan' },
+  ])
+})
+
+test('macos profile blocks sibling reads and writes', async (t) => {
+  if (process.platform !== 'darwin') { t.skip(); return }
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-confine-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  const mine = path.join(root, 'juan')
+  const other = path.join(root, 'other')
+  const shared = path.join(root, 'shared')
+  const additional = path.join(root, 'additional')
+  await mkdir(mine); await mkdir(other); await mkdir(shared); await mkdir(additional)
+  await writeFile(path.join(mine, 'own.txt'), 'own')
+  await writeFile(path.join(other, 'secret.txt'), 'secret')
+  await writeFile(path.join(shared, 'shared.txt'), 'shared')
+  await writeFile(path.join(additional, 'additional.txt'), 'additional')
+  const profile = path.join(root, 'workspace.sb')
+  await writeFile(profile, macosWorkspaceProfile(workspaceSiblingDenies(mine, '/Users/ada'), [shared, additional]))
+  const run = (file: string) => new Promise<{ code: number | null; stderr: string }>(resolve => {
+    const child = spawn('sandbox-exec', ['-f', profile, '/bin/cat', file], { stdio: ['ignore', 'pipe', 'pipe'] })
+    let stderr = ''
+    child.stderr.on('data', chunk => { stderr += chunk })
+    child.on('close', code => resolve({ code, stderr }))
+  })
+  assert.equal((await run(path.join(mine, 'own.txt'))).code, 0)
+  assert.equal((await run(path.join(shared, 'shared.txt'))).code, 0)
+  assert.equal((await run(path.join(additional, 'additional.txt'))).code, 0)
+  const blocked = await run(path.join(other, 'secret.txt'))
+  assert.notEqual(blocked.code, 0)
+  assert.match(blocked.stderr, /not permitted|Operation not permitted/i)
+})

package/test/workspace.test.ts

@@ -38,14 +38,18 @@ test('fresh mind is private; repeat initialization preserves customization and o
   const root = await mkdtemp(path.join(tmpdir(), 'ez-mind-'))
   const workspace = path.join(root, 'agent')
   try {
-    assert.equal((await initializeWorkspace(workspace)).length, 3)
-    assert.equal((await stat(path.join(workspace, 'SOUL.md'))).mode & 0o777, 0o600)
+    const purpose = path.join(root, 'purpose.md')
+    await writeFile(purpose, 'Research partner\n')
+    assert.deepEqual(await initializeWorkspace(workspace, purpose), ['AGENTS.md'])
+    assert.equal((await stat(path.join(workspace, 'AGENTS.md'))).mode & 0o777, 0o600)
+    assert.ok(!(await readdir(workspace)).includes('SOUL.md'))
+    assert.ok(!(await readdir(workspace)).includes('USER.md'))
     assert.ok(!(await readdir(workspace)).includes('MEMORY.md'))
-    await writeFile(path.join(workspace, 'SOUL.md'), 'A customized research partner')
+    await writeFile(path.join(workspace, 'AGENTS.md'), 'A customized research partner')
     await writeFile(path.join(workspace, 'MEMORY.md'), 'Existing knowledge')
     await writeFile(path.join(workspace, 'AGENT.md'), 'Legacy custom guidance')
     assert.deepEqual(await initializeWorkspace(workspace), [])
-    assert.equal(await readFile(path.join(workspace, 'SOUL.md'), 'utf8'), 'A customized research partner')
+    assert.match(await readFile(path.join(workspace, 'AGENTS.md'), 'utf8'), /A customized research partner/)
     assert.equal(await readFile(path.join(workspace, 'MEMORY.md'), 'utf8'), 'Existing knowledge')
     assert.equal(await readFile(path.join(workspace, 'AGENT.md'), 'utf8'), 'Legacy custom guidance')
     assert.ok(!(await readdir(workspace)).some(name => name.endsWith('.tmp')))
@@ -53,27 +57,36 @@ test('fresh mind is private; repeat initialization preserves customization and o
   } finally { await rm(root, { recursive: true, force: true }) }
 })
 
+test('fresh workspace refuses to invent a generic purpose', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'ez-purpose-required-'))
+  try {
+    await assert.rejects(initializeWorkspace(path.join(root, 'mind'), undefined), /purpose file is required/)
+  } finally { await rm(root, {recursive:true, force:true}) }
+})
+
 test('seed refuses a symlink without overwriting its target', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'ez-mind-'))
   try {
     const target = path.join(root, 'outside.md')
     await writeFile(target, 'untouched')
-    await symlink(target, path.join(root, 'SOUL.md'))
+    await symlink(target, path.join(root, 'AGENTS.md'))
     await assert.rejects(initializeWorkspace(root), /regular file/)
     assert.equal(await readFile(target, 'utf8'), 'untouched')
   } finally { await rm(root, { recursive: true, force: true }) }
 })
 
-test('new agents seed their own purpose once and preserve subsequent mind edits', async () => {
+test('new agents seed a purpose-scoped AGENTS.md once and preserve subsequent edits', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'ez-purpose-'))
   try {
     const purpose = path.join(root, 'purpose.md')
     const workspace = path.join(root, 'mind')
-    await writeFile(purpose, 'Family shopping assistant\n')
+    await writeFile(purpose, 'You are the shopping assistant for this family.\n\n### Responsibilities\n\nOrganize confirmed household shopping requests.\n')
     await initializeWorkspace(workspace, purpose)
-    assert.equal(await readFile(path.join(workspace, 'SOUL.md'), 'utf8'), 'Family shopping assistant\n')
-    await writeFile(path.join(workspace, 'SOUL.md'), 'My evolving purpose\n')
+    const agents = await readFile(path.join(workspace, 'AGENTS.md'), 'utf8')
+    assert.match(agents, /## Purpose\n\nYou are the shopping assistant for this family\./)
+    assert.match(agents, /### Responsibilities\n\nOrganize confirmed household shopping requests\./)
+    await writeFile(path.join(workspace, 'AGENTS.md'), 'My evolving purpose\n')
     await initializeWorkspace(workspace, purpose)
-    assert.equal(await readFile(path.join(workspace, 'SOUL.md'), 'utf8'), 'My evolving purpose\n')
+    assert.match(await readFile(path.join(workspace, 'AGENTS.md'), 'utf8'), /My evolving purpose/)
   } finally { await rm(root, {recursive:true, force:true}) }
 })

package/templates/agent/SOUL.md

@@ -1,11 +0,0 @@
-# Identity and purpose
-
-You are one person-shaped assistant serving one owner. Start as a practical
-personal assistant until the owner supplies a more specific purpose.
-
-Be concise, resourceful, and candid. Take useful reversible steps within the
-owner's request. Ask only when missing information changes what you should do.
-Verify real outcomes before claiming success. Get approval for purchases,
-spending, destructive actions, and other actions requiring owner permission.
-
-Adapt your purpose and working style from the owner's confirmed needs.

package/templates/agent/USER.md

@@ -1,5 +0,0 @@
-# Owner context
-
-No personal details have been provided yet. Record only relevant information
-the owner supplies or confirms: preferences, purpose, and working context.
-Keep detailed project or organization knowledge with its work in work/.